---
title: "List Steep Keys"
method: GET
path: "/api/v1/steep-keys"
tags: ["authed"]
---

# List Steep Keys

`GET /api/v1/steep-keys`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/steep-keys`
- Auth: none declared

The workspace's Steep keys, newest first, revoked ones included
(check status). A full page means more may exist.

## Query parameters

- `before_created_at` string, date-time, nullable: With before_id: the last row of the previous page's created_at, to read the next page.
- `before_id` string, uuid, nullable: With the sort cursor: the last row of the previous page's id.
- `limit` integer: The most keys to return.

## Response `200`

Successful Response

- SteepKeyResponse[]
  - `id` string, uuid, required: The key's id; rotation keeps it.
  - `label` string, nullable, required: A name to tell keys apart, if given.
  - `key` string, required: The full Steep key, safe in page source: it names the workspace and grants nothing on its own.
  - `key_prefix` string, required: The key's first characters, to recognize it.
  - `mode` 'live' | 'test', required
  - `status` 'active' | 'revoked', required
  - `allowed_origins` string[], required: The only web origins the key captures journeys from.
  - `capture_outlines` boolean, required: Whether journeys keep an outline of each page's structure.
  - `capture_typed_values` boolean, required: Whether journeys keep what users typed into fields.
  - `capture_address_ids` boolean, required: Whether journeys keep ids in page, link and request addresses; secret-looking segments stay masked.
  - `capture_query_values` boolean, required: Whether journeys keep the query values of the addresses the app requests, after redaction; needs typed values.
  - `capture_request_bodies` boolean, required: Whether journeys keep what the app sends with a request (JSON, form or text, up to 2 KB), after redaction; needs typed values.
  - `capture_response_bodies` boolean, required: Whether journeys keep what the server answers to requests users start, writes, failures and slow calls (JSON or text, up to 2 KB), after redaction; needs page outlines.
  - `respect_privacy_signals` boolean, required: Whether a browser sending Global Privacy Control is left uncaptured.
  - `signed_in_only` boolean, required: Whether only signed-in users' journeys are captured.
  - `retention_days` integer, required: How many days journeys are kept.
  - `ignore_selectors` string[], required: CSS selectors whose elements are never captured.
  - `capture_version` integer, required: Moves whenever a capture setting changes, so pages pick up the new settings.
  - `created_at` string, date-time, required: When the key was created.
  - `rotated_at` string, date-time, nullable, required: When the key was last rotated; null if never.
  - `revoked_at` string, date-time, nullable, required: When the key was revoked; null while it is active.
  - `last_event_at` string, date-time, nullable, required: When the key last delivered an event; null until then.
  - `rich_capture_available` boolean: Whether this workspace can turn on keeping ids, request query values and request and response bodies.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `422`: Validation error
- `500`: Internal server error

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/d23e9286b847?raw)